Secrets found in GitLab webhook URL

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_149
Category	Credential Hygiene
Severity	HIGH

Impact

Including secrets in a webhook URL comes with risks: • Actors who can access webhooks through the API will be able to access secrets • Third party systems logging webhook URLs could gain access to the secrets included in the URL • When part of an unencrypted HTTP request, a webhook URL exposes the secret to anyone with access to the traffic such as cache servers and firewalls • Placing secrets in a webhook URL makes it more difficult to rotate them An attacker could use these secrets to gain unauthorized access to services that are used to authenticate the webhook against.